{"action":"Upgrade gitea.com/gitea/runner to 1.0.9-0.20260731160927-34bfa1915022 or later.","affected":[{"fixed":"1.0.9-0.20260731160927-34bfa1915022","introduced":"0"}],"component":"gitea.com/gitea/runner","cve_ids":["CVE-2026-73802"],"ecosystem":"Go","epss":0.00545,"exploited":false,"fixed_versions":["1.0.9-0.20260731160927-34bfa1915022"],"ghsa_id":"GHSA-x4q3-gcj3-m6cf","id":"tcs_01M5KFRJ6W3R90Y7D7XHBS0WBJ","modified_at":"2026-10-07T17:55:44.795358931Z","published_at":"2026-10-02T23:18:12Z","references":["https://osv.dev/vulnerability/GHSA-x4q3-gcj3-m6cf","https://github.com/go-gitea/gitea/security/advisories/GHSA-x4q3-gcj3-m6cf","https://gitea.com/gitea/runner/pulls/1058","https://gitea.com/gitea/runner/releases/tag/v3.0.0","https://github.com/go-gitea/gitea"],"severity":{"label":"critical","score":9.9},"sources":[{"source":"osv","source_id":"GHSA-x4q3-gcj3-m6cf","url":"https://osv.dev/vulnerability/GHSA-x4q3-gcj3-m6cf"}],"summary":"gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled"}